If a credit card was opened in your name without your permission, you generally aren’t responsible for that debt under most state laws — but you need to act quickly and in the right order to shut the account down, keep it off your credit report, and stop collections. Start by calling the card issuer’s fraud department using a number from its official website.
Not sure where you fit? Use the “What Do I Do First?” tool and get a checklist built around how you found out.
The full playbook is below, including the federal rule most victims never use: with the right documents, credit bureaus must block identity-theft information within four business days. The details matter, so read the 605B section before you count on it.
What Do I Do First?
If someone opened a credit card in my name is where you are, answer five quick questions. The tool builds an ordered checklist in three phases: STOP IT, DOCUMENT IT, CLEAN IT UP. Nothing you select is saved or sent anywhere.
Prefer a table?
| How you found out | First step | Key document |
|---|---|---|
| Card or welcome letter arrived | Don’t activate or use the card. Call the issuer’s fraud line at a number you look up yourself. | The card, letter, and envelope (keep them until the issuer tells you otherwise) |
| Unfamiliar account on my credit report | Check that it’s really fraud (section 1), then call the creditor and freeze your credit. | The report page showing the account |
| Hard inquiry only | Contact the company named in the inquiry, then freeze and place a fraud alert. | The report page showing the inquiry and its date |
| Debt collector called | Don’t confirm personal details. Ask for written validation and dispute in writing. | The collector’s validation notice and letters |
| Denied credit | Read the denial notice, then request the free report from the bureau it names. | The denial (adverse action) notice |
First, Make Sure It’s Really Fraud
Most unfamiliar accounts are fraud. Some aren’t, and the fix is different. Spend ten minutes on these checks before you file anything:
- Did you, or someone with your permission, apply? Think about pre-approved offers, a store card offered at checkout, a co-signed account, or an authorized-user card a partner or relative added.
- Is the name just unfamiliar? Store cards are often issued by a bank under the retailer’s brand, and a collector or debt buyer may appear under a name you’ve never seen. Look at the open date, balance, and address on the entry instead of judging by the name alone.
- Is it someone else’s account on your file? If a person with a similar name, address, or Social Security number was merged into your file (a “mixed file”), you may be looking at their accounts. That is a dispute with the bureau, not identity theft, though you can still dispute it in writing.
- Is the message itself a scam? A fake “your card is approved” email or text may exist only to get you to click. Don’t use its links or phone numbers. Go to the issuer’s site by typing the address yourself.
- Have you checked all three reports? Equifax, Experian, and TransUnion can show different accounts. See How to Check Your Credit Score Free for how to pull them.
A strange name on your report isn’t always fraud.
Confirm with the creditor before you assume. But if you still don’t recognize the account after these checks, treat it as identity theft and move to the exact order.
Denied credit and don’t know why? The denial notice names the lender and the bureau it used. A denial you didn’t expect can be the first sign that someone applied using your details.
How common is this?
More common than most people think. According to the FTC’s Consumer Sentinel Network Data Book 2024 (published March 2025), credit card fraud was the most-reported type of identity theft.
| Measure | Figure |
|---|---|
| Identity theft reports, 2024 | 1,135,291 |
| Credit card reports (most-reported type) | 449,032 (about 39.6% of identity theft reports) |
| Credit card: new accounts | 406,110 |
| Credit card: existing accounts | 52,428 |
The Exact Order to Fix It (and Why Each Step Matters)
Nine steps in three phases. This is a recommended sequence that follows the approach on IdentityTheft.gov, not a single order the law requires. If you can only do one thing right now, call the issuer.
STOP IT: steps 1 to 3
Step 1: Call the issuer’s fraud department
Do this: Look up the fraud number on the issuer’s official website. Say you didn’t open this account and you’re reporting identity theft. Ask them to close it, flag it as fraud, and stop reporting it to the bureaus. Ask for written confirmation and for copies of the application and account records (identity theft victims can generally request these under FCRA § 609(e); IdentityTheft.gov has a sample letter). Write down the date, the representative’s name, and any reference number.
Why it matters: The issuer is the only one who can shut the account and stop new charges. Its reference number and written confirmation become evidence later.
Step 2: Freeze your credit at all three bureaus
Do this: Contact Equifax, Experian, and TransUnion separately through their official sites. Freezes are free by federal law and last until you lift them. Save the PIN or login you’re given.
Why it matters: A freeze keeps most new creditors from seeing your report, which stops most new-account fraud. It doesn’t close the account that’s already open. That’s steps 1 and 7.
Step 3: Place a fraud alert
Do this: Place an initial fraud alert (1 year) with one bureau. That bureau tells the other two.
Why it matters: Lenders are supposed to take extra steps to verify it’s really you. It works alongside a freeze, and placing an alert generally entitles you to a free report from each bureau. Freeze, alert, and lock compared.
DOCUMENT IT: steps 4 and 5
Step 4: File your report at IdentityTheft.gov
Do this: List every fraudulent account you know of. The site produces an FTC Identity Theft Report and a recovery plan with sample letters. Create an account so you can save and update the report, and download a copy.
Why it matters: The FTC report is the identity theft report the bureaus ask for in a block request, and an extended fraud alert requires one. It’s often sufficient without a police report, though some companies may ask for one.
Step 5: Pull all three credit reports
Do this: Get your reports at AnnualCreditReport.com. Mark every account, inquiry, address, and name variation you don’t recognize, and save copies. If you find more fraud after filing, update your IdentityTheft.gov report.
Why it matters: Fraud rarely stops at one account, and each bureau can differ. You’ll need the exact entries for the block letters. Step-by-step guide.
CLEAN IT UP: steps 6 to 9
Step 6: Send block requests under FCRA § 605B
Do this: Send a written request to each bureau that shows the fraud, using the template in the next sections. Use certified mail with a return receipt and keep copies.
Why it matters: For qualifying requests, the law requires the bureau to block the information within four business days of receiving everything it needs.
Step 7: Close the loop with the issuer and other creditors
Do this: Follow up in writing with the issuer from step 1. Contact every other company where you found fraud. Ask each for written confirmation that the account is closed as fraud and that it will stop reporting it. If a card you actually own was misused, that’s a different problem: see Unauthorized Credit Card Charges.
Why it matters: A bureau block and a creditor who lets go together keep the account from reappearing.
Step 8: Handle collectors in writing
Do this: Don’t confirm personal details on a call. Ask for written validation and dispute in writing. See the collections section.
Why it matters: A written dispute made in time generally makes the collector stop collecting the disputed portion until it responds.
Step 9: Keep a log, keep watching, consider an extended alert
Do this: Log every call and letter. Re-check your reports periodically (AnnualCreditReport.com currently offers them free weekly). With your FTC report, you can request an extended fraud alert, which lasts 7 years. Keep the freeze in place.
Why it matters: Stolen information can be reused, and a paper trail is what solves problems quickly when one comes back.
Do You Owe the Money?
Generally, no. IdentityTheft.gov states that under most state laws you’re not responsible for debts from new accounts opened in your name without your permission. “Generally” matters: state laws vary, and the rules turn on the facts.
What you generally don’t owe
- Charges on a new account you didn’t open or authorize.
- Interest and fees that the fraudulent account piled up.
What you may still owe, or need to do
- Accounts you did open or authorize. If you applied, or knowingly let someone use your information, it may not be treated as identity theft.
- Cooperation. Issuers may ask you to sign a fraud affidavit or send documents. Respond promptly.
- Timely action. Deadlines such as the 30-day collection dispute window reward people who move fast.
If the issuer says you’re responsible anyway
Ask for the application and account records in writing, send your FTC report, and dispute in writing. You can also file a complaint with the CFPB, and legal aid may help. Don’t pay a fraudulent debt just to make the calls stop. Dispute it first.
The Four-Business-Day Block (FCRA § 605B)
Under 15 U.S.C. § 1681c-2, a consumer reporting agency must block identity-theft-related information within 4 business days after it receives all four of these:
- Proof of your identity.
- A copy of your identity theft report.
- Identification of the specific information to block.
- A statement that the information doesn’t relate to any transaction you made.
Four business days, with the right documents.
The clock starts when the bureau has all four items, not when you first complain.
What the block is not
- Not every dispute. It applies to qualifying identity-theft block requests. An ordinary dispute follows a different, slower process (generally a 30-day investigation).
- Not unconditional. A bureau can decline or rescind a block in limited situations, such as when it was based on a material misrepresentation or you actually received goods, services, or money from the transaction.
- Not the whole cleanup. It handles what the bureau reports. You still need the issuer to close the account and stop reporting.
- Not a timeline. Nobody can promise how long it takes to fully clear your name.
Copy-ready letter 1: block request to a credit bureau
Send one to each bureau that shows the fraud. Get the bureau’s mailing address from its official identity-theft page or IdentityTheft.gov. Send copies, never originals.
[Your full name] [Street address, city, state, ZIP] [Phone number and email] [Date] [Credit bureau name] [Address from the bureau's official identity-theft page] Re: Request to block identity-theft information under FCRA Section 605B (15 U.S.C. 1681c-2) To whom it may concern: I am a victim of identity theft. I am asking you to block the following information from my credit file under Section 605B of the Fair Credit Reporting Act: Creditor or company name: [name as shown on my report] Account number (as shown): [number] Date opened or inquiry date: [date] Amount reported: [amount, if any] This information does not relate to any transaction that I made or authorized. Enclosed are: 1. Proof of my identity: a copy of my government-issued ID and proof of my address. 2. A copy of my FTC Identity Theft Report from IdentityTheft.gov [and my police report, if I have one]. 3. A copy of my credit report with the information above marked. Please block this information, notify the company that furnished it as the law requires, and send me written confirmation. Sincerely, [Signature] [Printed name]
Fraud Alert vs. Credit Freeze vs. Credit Lock
These three get confused constantly. Short version: a freeze restricts access to your file, an alert asks lenders to verify you, and a lock is a bureau product with its own terms. For identity theft, the free federal tools are the ones to start with (see the FTC’s Credit Freezes and Fraud Alerts page), and you don’t need a paid service to complete any step in this article.
| Tool | What it does | How long | Cost |
|---|---|---|---|
| Initial fraud alert | Asks businesses to verify your identity before extending credit. Placing it with one bureau notifies the others. | 1 year (renewable) | Free |
| Extended fraud alert | Same protection for longer. Requires an identity theft report, and the bureau you contact notifies the other two. | 7 years | Free |
| Credit freeze | Restricts access to your report so most new creditors can’t open accounts. You contact each of the three bureaus. | Until you lift it | Free by federal law |
| Credit lock | A bureau product that works like a freeze. Terms are set by each bureau. | Varies | Varies; check the terms |
Should you freeze after identity theft? Generally yes, and many people use a freeze and an alert together. The trade-off: you’ll need to lift the freeze at the relevant bureau when you apply for credit yourself. A freeze doesn’t stop misuse of accounts you already have, and it doesn’t protect your tax return (see the IRS section).
What If It’s Only a Hard Inquiry?
A hard inquiry is generally tied to a credit application. If you see one you don’t recognize, someone may have applied using your information. The application might have been denied, or the account might not have been reported yet.
- Rule out the innocent explanation. A car dealer, apartment application, or store card at checkout can each cause an inquiry.
- Contact the company named in the inquiry. Use a number you find yourself. Ask whether an application was submitted in your name, and report identity theft if it wasn’t yours.
- Freeze and place a fraud alert now. Don’t wait for an account to appear.
- File your FTC report and keep the report page showing the inquiry.
- Dispute it if it’s inaccurate. A block request may cover identity-theft-related inquiries. Use letter 1 and identify the inquiry.
Then re-check all three reports in a few weeks in case an account appears.
What If It’s Already in Collections?
A collector calling about a card you never opened is stressful, and some collection calls are scams themselves. Don’t give a caller your Social Security number, bank details, or a code, and don’t confirm personal information. Ask for written notice and work from that.
- Get validation in writing. A validation notice tells you who the collector says you owe.
- Dispute in writing within 30 days of the notice. Under the CFPB’s guidance, a timely written dispute generally requires the collector to stop collecting the disputed portion until it responds. Use certified mail and keep a copy.
- Include your FTC Identity Theft Report. IdentityTheft.gov has steps and letters for identity-theft debts.
- Dispute with the bureaus and the original creditor too (see the 605B block).
- Don’t ignore court papers. If you’re sued, respond by the deadline and get legal help.
More detail in Debt Validation Letter and Debt Collector Rights.
Copy-ready letter 2: dispute to a debt collector
[Your full name] [Street address, city, state, ZIP] [Date] [Collector name and address, from their notice] Re: Dispute of debt. Reference/account number: [number] I am writing in response to your [notice/contact] dated [date]. I dispute this debt in its entirety. I did not open this account. It is the result of identity theft. A copy of my FTC Identity Theft Report is enclosed. Please stop collection of this disputed debt until you have verified it. Please send me verification, including a copy of the application and account records, and the name and address of the original creditor. Please direct all further communication to me in writing at the address above. If you report this debt to any credit reporting agency, please report it as disputed. Sincerely, [Signature] [Printed name]
What If a Family Member Opened It?
This is one of the hardest versions, and it’s more common than people say. The protective steps are the same as anyone else’s, and you don’t have to settle the family question before you protect your credit.
- Do the steps in the exact order first. Freeze, alert, and issuer report protect you no matter who did it.
- The FTC report is often sufficient. Some companies may ask for a police report. Whether to file one is your decision, and it can affect your family, so think it through.
- Say only what you know. The block statement says the account doesn’t relate to a transaction you made. If you gave permission for the account, the identity-theft process may not fit your situation.
- Consider talking with legal aid or a consumer attorney about your rights and options before you take formal steps. This article covers rights and procedures, not what to do about the relationship.
- Lock down your information. Keep documents with your Social Security number somewhere others can’t reach.
What If It’s in Your Child’s Name?
A child usually has no credit history, which makes a file in their name a red flag. Fraud on a child’s identity can go unnoticed for years. The FTC has specific steps for child identity theft, including freezing a child’s credit.
- Ask each bureau whether a credit file exists for your child. Have proof that you’re the parent or guardian and your child’s identifying documents ready.
- Request a freeze for your child at each of the three bureaus. Parents can generally do this for free for a child under 16, and guardians or conservators can do it for someone they legally represent, with proof of authority.
- Contact the company where the fraudulent account was opened and explain that the child didn’t open it.
- File a report at IdentityTheft.gov in your child’s name, then use it for block requests (letter 1, with your proof of authority).
- Consider your own credit. If your information was exposed, freeze and place an alert on yours too.
- Consider an IRS Identity Protection PIN for a dependent (see below).
If Your SSN Is Out There: Protect Your Tax Return
If someone has your Social Security number, they can also try to file a tax return in your name. A credit freeze doesn’t stop that. The IRS offers an Identity Protection PIN (IP PIN): a 6-digit number, new each year, that must be on your return.
- Anyone with an SSN or ITIN who can verify their identity can get one through the IRS’s IP PIN page.
- Parents and guardians can request one for a dependent.
- Share it only with your tax software or preparer. Never with a caller.
- If your e-filed return is rejected because one was already filed, the IRS has an Identity Theft Affidavit (Form 14039).
What This Isn’t
- Charges on a card you already have. That’s a different process: Unauthorized Credit Card Charges.
- How to pull your reports. How to Check Your Credit Score Free.
- Rebuilding your score. After cleanup, see How to Fix Your Credit Score Fast.
- Being tricked into sending money or sharing a code. Scam recovery has its own traps: Your Bank Doesn’t Have to Refund a Zelle Scam.
FAQ
Someone opened a credit card in my name. What do I do first?
Call the issuer’s fraud department using a number from its official website, freeze your credit at all three bureaus, place a fraud alert, and start your report at IdentityTheft.gov. Then follow the nine steps.
Am I responsible for a credit card I didn’t open?
Generally no. IdentityTheft.gov states that under most state laws you’re not responsible for debts from new accounts opened without your permission. State laws vary, and accounts you authorized are treated differently.
I got a credit card I never applied for. Now what?
Don’t activate or use it. Look up the issuer’s fraud number yourself and report that you didn’t apply. Keep the card and envelope until the issuer tells you what to do. Then freeze your credit and place an alert.
I got an approval email for a card I didn’t request. Is it real?
It could be either. Don’t click links or call numbers in it. Go to the issuer’s site by typing the address, or check your credit reports for a new account or inquiry.
Do I need a police report?
Often the FTC Identity Theft Report is sufficient, but some companies may ask for a police report. It’s worth asking the issuer what it needs.
What is an FTC Identity Theft Report?
It’s the report you generate at IdentityTheft.gov after listing the fraud. It’s the document bureaus look for in a block request, and an extended fraud alert requires one.
How long does an extended fraud alert last?
7 years, and it requires an identity theft report. The bureau you contact tells the other two. An initial alert lasts 1 year and can be renewed.
Should I freeze my credit after identity theft?
Generally yes. Freezes are free by federal law and last until you lift them. You contact each of the three bureaus. You’ll need to lift the freeze when you apply for credit yourself.
What’s the difference between a fraud alert, a freeze, and a lock?
An alert asks lenders to verify you, a freeze restricts access to your file, and a lock is a bureau product with varying terms. See the table.
Will a freeze hurt my credit score?
No. According to the FTC, a freeze doesn’t affect your credit score or your ability to use your existing cards. It just keeps new lenders from seeing your file.
How do I remove a fraudulent account from my credit report?
Report it to the issuer, file your FTC report, and send each bureau a block request with the required documents. See the 605B section.
The bureau won’t remove the fraudulent account. What now?
Check that your request included all four required items. Bureaus can decline in limited situations, so ask for the reason in writing. You can also dispute with the company reporting it, file a CFPB complaint, or contact legal aid.
Does the four-business-day block apply to every dispute?
No. It applies to qualifying identity-theft block requests that include the required documents. Ordinary disputes follow a different process.
How long until my credit is fixed?
There’s no reliable timeline. It depends on the issuer, the bureaus, and whether more accounts turn up. Keep your log and keep checking your reports.
A collector says I owe a card I didn’t open. Should I pay to make it go away?
No. Ask for written validation and dispute in writing, ideally within 30 days of the validation notice. See the collections section.
Can I be sued over a debt from identity theft?
It can happen, especially if a collector believes the debt is yours. Never ignore court papers. Respond by the deadline and get legal help.
Does a hard inquiry I didn’t authorize mean I’m a fraud victim?
Not always. Check whether you (or a dealer, landlord, or store) applied. If not, treat it as possible fraud and follow that section.
Someone used my SSN. What else should I do?
Get an IRS Identity Protection PIN and keep your credit frozen. See the IRS section.
A family member opened the card. What are my options?
The protective steps are the same as anyone else’s, and you don’t have to resolve the family question first. Legal aid or a consumer attorney can explain your rights. See that section.
Can someone open a credit card in my child’s name?
Yes, and it can go unnoticed for years. Ask the bureaus whether a file exists and request a freeze for your child. See that section.
How can I tell it’s really the issuer calling me?
You can’t be sure from the phone alone. Hang up and call the number on the issuer’s official website. Never give your Social Security number or a code to someone who contacted you.
Sources: FTC Consumer Sentinel Network Data Book 2024; IdentityTheft.gov (recovery steps, your rights, sample letters); 15 U.S.C. § 1681c-2; FTC guidance on credit freezes and fraud alerts and on child identity theft; CFPB guidance on credit report disputes, debt validation, and inquiries; IRS: Get an Identity Protection PIN.
Last updated:
This article is for educational purposes only and is not legal advice. State laws vary, and every situation is different. For advice about your situation, consider speaking with a licensed attorney or a legal aid organization.
Daniel Hayes is the founder and sole researcher at AdvoraHQ. He covers U.S. personal finance, insurance, and consumer law — working directly from IRS publications, federal and state statutes, court opinions, and SEC filings rather than secondary summaries. His focus is the gap between what readers think they know and what the source documents actually say. Daniel is not a licensed attorney, CPA, or financial advisor; his articles are educational and not personalized advice. Reach him at Daniel.Hayes@advorahq.com.
